Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to remove an obsolete SID (the account was apparently deleted).

I've tried to run the following on the server (win2003) and a client (win7):

icacls c:\path /remove *S-1-5-21-1883347182-1220252494-433279356-1095 /T

But I always get the output

Successfully processed 0 files; Failed processing 0 files

without it doing anything. How can I get it to work?


I've used AccessEnum to get the SID because icacls only says "No mapping between account names and security IDs was done." but doesn't show the sid.

The output from AccessEnum is:

"Path"  "Read"  "Write" "Deny"  
"c:\path"   "Administrators, S-1-5-21-1883347182-1220252494-433279356-1095, ..."    "Administrators, S-1-5-21-1883347182-1220252494-433279356-1095, ..."    ""  
share|improve this question
Could you post a relevant snip of the output of icacls "C:\path"? Are you positive that SID is correct? – jscott Jul 30 '10 at 13:05
Yes, AFAIK the SID is correct - see my update. – laktak Aug 2 '10 at 12:23
Does this SID have an entry in the ACL of the parent folder, C:\ in your question? If not, you may be able to use the /reset switch of icalcs -- e.g. icacls C:\path /reset /T – jscott Aug 5 '10 at 21:22
I also have this problem, and I see exactly the same behaviour from icacls... still looking for an answer. – Thanatos Oct 7 '10 at 23:55
up vote 1 down vote accepted

My suggestion to another similar question

"perhaps you're looking for SUBINACL. Download it here

subinacl.exe /help /cleandeletedsidsfrom provides the following:


delete all ACEs containing deleted (no valid) Sids from DomainName You can specify which part of the security descriptor will be scanned (default=all) If the owner is deleted, new owner will be the Administrators group. If the primary group is deleted, new primary group will be the Users group. Appears you can use this with /file or /share or /subdirectories as needed

share|improve this answer

You can easily do that with SetACL:

SetACL -on C:\Path -ot file -actn trustee -trst 
share|improve this answer

I have found the most portable and actually easiest way to be using the /save and /restore functions of icacls:

icacls C:\ /save D:\creds.txt /T

And then I would use Vim, or some other gred/sed/awk equivalent to manipulate the file. That allows me to remove SID, replace SID, etc. After I'm finished with the file I do

icacls C:\ /restore D:\ /T

That it. No need to download other programs. No need to learn yet another non standard command line syntax. I just create a dummy file and use the GUI or whatever to make the ACL exactly the way I want it, use /save to see how the resultant ACE string looks like, then just copy and paste that ACE string into

share|improve this answer

Why not just use the GUI? Bring up the folder properties and remove the unwanted SID from the security settings. That's always worked for me.

share|improve this answer
Yes, but we have thousands of folders! I would prefer to use the AccessEnum output in a script :) – laktak Aug 3 '10 at 4:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.